Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added support to set builder and fn pod specs via helm chart (#2461)

Browse Source 
The users can now set the pod spec for builder and fn pods via helm chart.
Currently we have set some default securitycontext for the pods. Before there were no permissions set and the user would by default enter root when kubectl exec into pod. Now the permissions have been set and the user will not be able to access root directory in poolmgr and newdeploy pods.
This commit is contained in:
Ankit Chawla
2022-06-27 16:52:28 +05:30
committed by GitHub
parent 21ea35b02a
commit 473acc4e2b
18 changed files with 287 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/executor/executor.go
+14 -2
View File
@@ -28,6 +28,7 @@ import (
"github.com/dchest/uniuri"
"github.com/pkg/errors"
"go.uber.org/zap"
apiv1 "k8s.io/api/core/v1"
k8sInformers "k8s.io/client-go/informers"
k8sCache "k8s.io/client-go/tools/cache"
@@ -270,6 +271,17 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st
executorInstanceID := strings.ToLower(uniuri.NewLen(8))
var podSpecPatch *apiv1.PodSpec
namespace, err := utils.GetCurrentNamespace()
if err != nil {
logger.Warn("Current namespace not found %s", zap.Error(err))
} else {
podSpecPatch, err = util.GetSpecFromConfigMap(ctx, kubernetesClient, fv1.RuntimePodSpecConfigmap, namespace)
if err != nil {
logger.Warn("Either configmap is not found or error reading data %v", zap.Error(err))
}
}
logger.Info("Starting executor", zap.String("instanceID", executorInstanceID))
informerFactory := genInformer.NewSharedInformerFactory(fissionClient, time.Minute*30)
@@ -288,7 +300,7 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st
fissionClient, kubernetesClient, metricsClient,
functionNamespace, fetcherConfig, executorInstanceID,
funcInformer, pkgInformer, envInformer,
gpmPodInformer, gpmRsInformer)
gpmPodInformer, gpmRsInformer, podSpecPatch)
if err != nil {
return errors.Wrap(err, "pool manager creation failed")
}
@@ -304,7 +316,7 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st
fissionClient, kubernetesClient,
functionNamespace, fetcherConfig, executorInstanceID,
funcInformer, envInformer,
ndmDeplInformer, ndmSvcInformer)
ndmDeplInformer, ndmSvcInformer, podSpecPatch)
if err != nil {
return errors.Wrap(err, "new deploy manager creation failed")
}
pkg/executor/executortype/newdeploy/newdeploy.go
+10
View File
@@ -278,6 +278,16 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
},
}
if deploy.podSpecPatch != nil {
updatedPodSpec, err := util.MergePodSpec(&pod.Spec, deploy.podSpecPatch)
if err == nil {
pod.Spec = *updatedPodSpec
} else {
deploy.logger.Warn("Failed to merge the specs: %v", zap.Error(err))
}
}
pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
deployment := &appsv1.Deployment{
pkg/executor/executortype/newdeploy/newdeploymgr.go
+5
View File
@@ -86,6 +86,8 @@ type (
svcListerSynced k8sCache.InformerSynced
hpaops *hpautils.HpaOperations
podSpecPatch *apiv1.PodSpec
}
)
@@ -101,6 +103,7 @@ func MakeNewDeploy(
envInformer finformerv1.EnvironmentInformer,
deplInformer appsinformers.DeploymentInformer,
svcInformer coreinformers.ServiceInformer,
podSpecPatch *apiv1.PodSpec,
) (executortype.ExecutorType, error) {
enableIstio := false
if len(os.Getenv("ENABLE_ISTIO")) > 0 {
@@ -129,6 +132,8 @@ func MakeNewDeploy(
defaultIdlePodReapTime: 2 * time.Minute,
hpaops: hpautils.NewHpaOperations(logger, kubernetesClient, instanceID),
podSpecPatch: podSpecPatch,
}
nd.deplLister = deplInformer.Lister()
pkg/executor/executortype/poolmgr/gp.go
+4 -1
View File
@@ -78,6 +78,7 @@ type (
readyPodQueue workqueue.DelayingInterface
poolInstanceID string // small random string to uniquify pod names
instanceID string // poolmgr instance id
podSpecPatch *apiv1.PodSpec
// TODO: move this field into fsCache
podFSVCMap sync.Map
}
@@ -95,7 +96,8 @@ func MakeGenericPool(
fsCache *fscache.FunctionServiceCache,
fetcherConfig *fetcherConfig.Config,
instanceID string,
enableIstio bool) *GenericPool {
enableIstio bool,
podSpecPatch *apiv1.PodSpec) *GenericPool {
gpLogger := logger.Named("generic_pool")
@@ -130,6 +132,7 @@ func MakeGenericPool(
poolInstanceID: uniuri.NewLen(8),
instanceID: instanceID,
podFSVCMap: sync.Map{},
podSpecPatch: podSpecPatch,
}
gp.runtimeImagePullPolicy = utils.GetImagePullPolicy(os.Getenv("RUNTIME_IMAGE_PULL_POLICY"))
pkg/executor/executortype/poolmgr/gp_deployment.go
+10
View File
@@ -150,6 +150,16 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme
},
}
if gp.podSpecPatch != nil {
updatedPodSpec, err := util.MergePodSpec(&pod.Spec, gp.podSpecPatch)
if err == nil {
pod.Spec = *updatedPodSpec
} else {
gp.logger.Warn("Failed to merge the specs: %v", zap.Error(err))
}
}
pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
poolsize := getEnvPoolSize(env)
pkg/executor/executortype/poolmgr/gpm.go
+5 -1
View File
@@ -92,6 +92,8 @@ type (
defaultIdlePodReapTime time.Duration
poolPodC *PoolPodController
podSpecPatch *apiv1.PodSpec
}
request struct {
requestType
@@ -119,6 +121,7 @@ func MakeGenericPoolManager(
envInformer finformerv1.EnvironmentInformer,
podInformer coreinformers.PodInformer,
rsInformer appsinformers.ReplicaSetInformer,
podSpecPatch *apiv1.PodSpec,
) (executortype.ExecutorType, error) {
gpmLogger := logger.Named("generic_pool_manager")
@@ -150,6 +153,7 @@ func MakeGenericPoolManager(
fetcherConfig: fetcherConfig,
enableIstio: enableIstio,
poolPodC: poolPodC,
podSpecPatch: podSpecPatch,
}
gpm.podLister = podInformer.Lister()
gpm.podListerSynced = podInformer.Informer().HasSynced
@@ -476,7 +480,7 @@ func (gpm *GenericPoolManager) service() {
}
pool = MakeGenericPool(gpm.logger, gpm.fissionClient, gpm.kubernetesClient,
gpm.metricsClient, req.env, ns, gpm.namespace, gpm.fsCache,
gpm.fetcherConfig, gpm.instanceID, gpm.enableIstio)
gpm.fetcherConfig, gpm.instanceID, gpm.enableIstio, gpm.podSpecPatch)
err = pool.setup(req.ctx)
if err != nil {
req.responseChannel <- &response{error: err}
pkg/executor/executortype/poolmgr/poolpodcontroller_test.go
+1 -1
View File
@@ -78,7 +78,7 @@ func TestPoolPodControllerPodCleanup(t *testing.T) {
fissionClient, kubernetesClient, metricsClient,
fnNamespace, fetcherConfig, executorInstanceID,
funcInformer, pkgInformer, envInformer,
gpmPodInformer, gpmRsInformer)
gpmPodInformer, gpmRsInformer, nil)
if err != nil {
t.Fatalf("Error creating generic pool manager: %v", err)
}
pkg/executor/util/util.go
+15
View File
@@ -25,6 +25,7 @@ import (
apiv1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"sigs.k8s.io/yaml"
fv1 "github.com/fission/fission/pkg/apis/core/v1"
)
@@ -113,3 +114,17 @@ func ConvertConfigSecrets(ctx context.Context, fn *fv1.Function, kc kubernetes.I
}
return envFromSources, nil
}
func GetSpecFromConfigMap(ctx context.Context, kubeClient kubernetes.Interface, cm string, cmns string) (*apiv1.PodSpec, error) {
podSpecPatch, err := kubeClient.CoreV1().ConfigMaps(cmns).Get(ctx, cm, metav1.GetOptions{})
if err != nil {
return nil, err
}
var additionalSpec apiv1.PodSpec
err = yaml.Unmarshal([]byte(podSpecPatch.Data["spec"]), &additionalSpec)
return &additionalSpec, err
}
pkg/executor/util/util_test.go
+114
View File
@@ -0,0 +1,114 @@
/*
Copyright 2016 The Fission Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package util
import (
"context"
"reflect"
"testing"
apiv1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes/fake"
)
func TestGetSpecFromConfigMap(t *testing.T) {
kubeClient := fake.NewSimpleClientset()
var permissionNum int64 = 10001
var runAsNonRoot bool = true
configMapData := make(map[string]string, 0)
specPatch := `
securityContext:
fsGroup: 10001
runAsGroup: 10001
runAsNonRoot: true
runAsUser: 10001`
configMapData["spec"] = specPatch
testConfigMap := apiv1.ConfigMap{
TypeMeta: metav1.TypeMeta{
Kind: "ConfigMap",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "test-config-map",
Namespace: "fission",
},
Data: configMapData,
}
configmap, err := kubeClient.CoreV1().ConfigMaps("fission").Create(context.Background(), &testConfigMap, metav1.CreateOptions{})
if err != nil {
t.Errorf("Error creating configmap %v", err)
}
t.Logf("Configmap: %v", configmap.Data)
testSpecPatch := apiv1.PodSpec{
SecurityContext: &apiv1.PodSecurityContext{
FSGroup: &permissionNum,
RunAsGroup: &permissionNum,
RunAsNonRoot: &runAsNonRoot,
RunAsUser: &permissionNum,
},
}
tests := []struct {
name string
cm string
cmns string
want *apiv1.PodSpec
wantErr bool
}{
{
name: "Configmap exists",
cm: "test-config-map",
cmns: "fission",
want: &testSpecPatch,
wantErr: false,
},
{
name: "Configmap does not exists",
cm: "wrongname",
cmns: "fission",
want: nil,
wantErr: true,
},
{
name: "Wrong namespace",
cm: "test-config-map",
cmns: "fissio",
want: nil,
wantErr: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := GetSpecFromConfigMap(context.Background(), kubeClient, tt.cm, tt.cmns)
if (err != nil) != tt.wantErr {
t.Errorf("GetSpecFromConfigMap() error = %v, wantErr %v", err, tt.wantErr)
return
}
if !reflect.DeepEqual(got, tt.want) {
t.Errorf("GetSpecFromConfigMap() got = %v, want %v", got, tt.want)
}
})
}
}